init release verify subcommands by ejahnGithub · Pull Request #11018 · cli/cli

ejahnGithub · 2025-05-23T19:52:27Z

This PR adds two beta gh release subcommands—verify and verify-asset—to support release attestations. Both commands are still in the testing phase and not yet exposed in the public CLI.

Here’s a clean summary of the expected output for the new gh release verify and gh release verify-asset subcommands:

Expected output:

gh release verify with tag

❯ ./bin/gh release verify v5 --repo bdehamer/delme

Resolved v5 to sha1:c5e17a62e06a1d201570249c61fae531e9244e1b
Loaded 1 attestation from GitHub API
The following 1 attestation matched the policy criteria

✓ Verification succeeded!

Attestation found matching release v5 (c5e17a62e06a1d201570249c61fae531e9244e1b)
  a.zip          sha256:f7165848f9f5ddc578d7adbd1f566a394169385c73bd88bf60df7e759db8e08d
  b.zip          sha256:8b7eb1572346692ffd3ae01248c70a341ae3aa8be1df8b12346b50acb9002282

gh release verify without tag

❯ ./bin/gh release verify --repo bdehamer/delme

Resolved v5 to sha1:c5e17a62e06a1d201570249c61fae531e9244e1b
Loaded 1 attestation from GitHub API
The following 1 attestation matched the policy criteria

✓ Verification succeeded!

Attestation found matching release v5 (c5e17a62e06a1d201570249c61fae531e9244e1b)
  a.zip          sha256:f7165848f9f5ddc578d7adbd1f566a394169385c73bd88bf60df7e759db8e08d
  b.zip          sha256:8b7eb1572346692ffd3ae01248c70a341ae3aa8be1df8b12346b50acb9002282

gh release verify-asset with tag

❯ ./bin/gh release verify-asset v5 ./pkg/cmd/attestation/test/data/github_release_artifact.zip --repo bdehamer/delme

Loaded digest sha256:f7165848f9f5ddc578d7adbd1f566a394169385c73bd88bf60df7e759db8e08d for github_release_artifact.zip
Resolved v5 to sha1:c5e17a62e06a1d201570249c61fae531e9244e1b
Loaded 1 attestation from GitHub API
The following 1 attestation matched the policy criteria

✓ Verification succeeded!
Attestation found matching release v5 (sha1:c5e17a62e06a1d201570249c61fae531e9244e1b)
github_release_artifact.zip is present in release v5

gh release verify-asset without tag

❯ ./bin/gh release verify-asset ./pkg/cmd/attestation/test/data/github_release_artifact.zip --repo bdehamer/delme

Loaded digest sha256:f7165848f9f5ddc578d7adbd1f566a394169385c73bd88bf60df7e759db8e08d for github_release_artifact.zip
Resolved v5 to sha1:c5e17a62e06a1d201570249c61fae531e9244e1b
Loaded 1 attestation from GitHub API
The following 1 attestation matched the policy criteria

✓ Verification succeeded!
Attestation found matching release v5 (sha1:c5e17a62e06a1d201570249c61fae531e9244e1b)
github_release_artifact.zip is present in release v5

pkg/cmd/release/attestation/options.go

cliAutomation · 2025-05-30T17:01:43Z

Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.

andyfeller

@ejahnGithub : I will need to devote more time to really grok everything going on here, but I wanted to provide some initial feedback that I think is important to discuss further from a maintenance perspective.

go.mod

pkg/cmd/release/verify/verify_test.go

pkg/cmd/attestation/test/data/github_release_artifact.zip

pkg/cmd/release/attestation/attestation.go

pkg/cmd/release/shared/fetch.go

pkg/cmd/release/verify-asset/verify-asset.go

cliAutomation · 2025-05-30T21:10:13Z

Hi! Thanks for the pull request. Please ensure that this change is linked to an issue by mentioning an issue number in the description of the pull request. If this pull request would close the issue, please put the word 'Fixes' before the issue number somewhere in the pull request body. If this is a tiny change like fixing a typo, feel free to ignore this message.

pkg/cmd/release/shared/attestation.go

pkg/cmd/attestation/artifact/artifact.go

malancas · 2025-06-02T18:55:40Z

pkg/cmd/release/shared/fetch.go


+func FetchRefSHA(ctx context.Context, httpClient *http.Client, repo ghrepo.Interface, tagName string) (string, error) {
+	path := fmt.Sprintf("repos/%s/%s/git/refs/tags/%s", repo.RepoOwner(), repo.RepoName(), tagName)
+	req, err := http.NewRequestWithContext(ctx, "GET", ghinstance.RESTPrefix(repo.RepoHost())+path, nil)


I think there are some built in functions in the gh-go library for making HTTP requests we can leverage.

pkg/cmd/release/shared/options.go

pkg/cmd/release/verify-asset/verify-asset.go

pkg/cmd/release/shared/options.go

Signed-off-by: Brian DeHamer <bdehamer@github.com>

bdehamer · 2025-06-05T17:51:22Z

@andyfeller / @malancas

With @ejahnGithub out for a couple of weeks I'm taking over responsibility for this PR. I've gone through and done a bit of refactoring and attempted to address your feedback in the process. Would appreciate you each taking another look.

andyfeller

Overall this is looking a lot easier to understand, thanks!

I added a few suggestions and questions given my unfamiliarity with the release asset verification capability.

pkg/cmd/release/verify-asset/verify_asset.go

andyfeller

LGTM

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.74.2` -> `v2.76.1` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.76.1`](https://github.com/cli/cli/releases/tag/v2.76.1): GitHub CLI 2.76.1 [Compare Source](cli/cli@v2.76.0...v2.76.1) #### `gh pr create` regression fix This release fixes a regression introduced in `v2.76.0` where organization teams were retrieved outside of intentional use cases. This caused problems for GitHub Enterprise Server users using the GitHub Actions automatic token that does not have access to organization teams. For more information, see cli/cli#11360 #### What's Changed ##### 🐛 Fixes - Fix: `gh pr create`, only fetch teams when reviewers contain a team by [@BagToad](https://github.com/BagToad) in cli/cli#11361 ##### 📚 Docs & Chores - add tenancy aware for san matcher by [@ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11261 - Run Lint and Tests on `push` to `trunk` branch by [@andyfeller](https://github.com/andyfeller) in cli/cli#11325 - update ownership of pkg/cmd/release/shared/ by [@ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11326 - Automate spam issue detection by [@babakks](https://github.com/babakks) in cli/cli#11316 - Improve `api` `--preview` docs by [@jsoref](https://github.com/jsoref) in cli/cli#11274 - Incorporate govulncheck into workflows by [@andyfeller](https://github.com/andyfeller) in cli/cli#11332 - chore(deps): bump advanced-security/filter-sarif from 1.0.0 to 1.0.1 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11298 - chore(deps): bump github.com/sigstore/sigstore-go from 1.0.0 to 1.1.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11307 **Full Changelog**: cli/cli@v2.76.0...v2.76.1 ### [`v2.76.0`](https://github.com/cli/cli/releases/tag/v2.76.0): GitHub CLI 2.76.0 [Compare Source](cli/cli@v2.75.1...v2.76.0) ####

Copilot Coding Agent Support GitHub Copilot Pro+ and Copilot Enterprise subscribers can now assign issues to GitHub Copilot during issue creation using: - Command-line flag: `gh issue create --assignee @copilot` - Launching web browser: `gh issue create --assignee @copilot --web` - Or interactively selecting `Copilot (AI)` as assignee in `gh issue create` metadata For more details, refer to [the full changelog post for Copilot coding agent](https://github.blog/changelog/2025-05-19-github-copilot-coding-agent-in-public-preview/). #### What's Changed ##### ✨ Features - Assign Copilot during `gh issue create` by [@andyfeller](https://github.com/andyfeller) in cli/cli#11279 - Display immutable field in `release view` command by [@bdehamer](https://github.com/bdehamer) in cli/cli#11251 ##### 🐛 Fixes - FIX: Do not fetch logs for skipped jobs by [@babakks](https://github.com/babakks) in cli/cli#11312 - Transform `extension` and `filename` qualifiers into `path` qualifier for web code search by [@samcoe](https://github.com/samcoe) in cli/cli#11211 ##### 📚 Docs & Chores - FIX: Workflow does not contain permissions by [@BagToad](https://github.com/BagToad) in cli/cli#11322 - Add automated feature request response workflow by [@BagToad](https://github.com/BagToad) in cli/cli#11299 **Full Changelog**: cli/cli@v2.75.1...v2.76.0 ### [`v2.75.1`](https://github.com/cli/cli/releases/tag/v2.75.1): GitHub CLI 2.75.1 [Compare Source](cli/cli@v2.75.0...v2.75.1) #### What's Changed ##### 🐛 Fixes - Ensure hostnames are visible in CLI website by [@andyfeller](https://github.com/andyfeller) in cli/cli#11295 - Revert "Fix: `gh pr create` prioritize `--title` and `--body` over `--fill` when `--web` is present" by [@andyfeller](https://github.com/andyfeller) in cli/cli#11300 ##### 📚 Docs & Chores - Ensure go directive is always .0 version in bump by [@williammartin](https://github.com/williammartin) in cli/cli#11259 - Minor (1-word) documentation typo in generated `~/.config/gh/config.yml` by [@kurahaupo](https://github.com/kurahaupo) in cli/cli#11246 - Automate closing of stale issues by [@babakks](https://github.com/babakks) in cli/cli#11268 - Filter the `third-party/` folder out of CodeQL results by [@BagToad](https://github.com/BagToad) in cli/cli#11278 - Exclude `third-party` source from golangci-lint by [@andyfeller](https://github.com/andyfeller) in cli/cli#11293 #####

Dependencies - Bump Go to 1.24.5 by [@github-actions](https://github.com/github-actions)\[bot] in cli/cli#11255 - chore(deps): bump github.com/sigstore/protobuf-specs from 0.4.3 to 0.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11263 - chore(deps): bump golang.org/x/term from 0.32.0 to 0.33.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11266 - chore(deps): bump golang.org/x/sync from 0.15.0 to 0.16.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11264 - chore(deps): bump golang.org/x/text from 0.26.0 to 0.27.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11265 - chore(deps): bump golang.org/x/crypto from 0.39.0 to 0.40.0 by [@dependabot](https://github.com/dependabot)\[bot] in cli/cli#11275 #### New Contributors - [@kurahaupo](https://github.com/kurahaupo) made their first contribution in cli/cli#11246 - [@github-actions](https://github.com/github-actions)\[bot] made their first contribution in cli/cli#11255 **Full Changelog**: cli/cli@v2.75.0...v2.75.1 ### [`v2.75.0`](https://github.com/cli/cli/releases/tag/v2.75.0): GitHub CLI 2.75.0 [Compare Source](cli/cli@v2.74.2...v2.75.0) #### What's Changed ##### ✨ Features - init release verify subcommands by [@ejahnGithub](https://github.com/ejahnGithub) in cli/cli#11018 - Embed Windows resources (VERSIONINFO) during build by [@babakks](https://github.com/babakks) in cli/cli#11048 - Support `--no-repos-selected` on `gh secret set` by [@williammartin](https://github.com/williammartin) in cli/cli#11217 ##### 🐛 Fixes - Fix: `gh pr create` prioritize `--title` and `--body` over `--fill` when `--web` is present by [@dankrzeminski32](https://github.com/dankrzeminski32) in cli/cli#10547 - fix: get token for active user instead of blank if possible by [@anuraaga](https://github.com/anuraaga) in cli/cli#11038 - Use Actions API to retrieve job run logs as a fallback mechanism by [@babakks](https://github.com/babakks) in cli/cli#11172 - Fix query object state mutation during pagination by [@babakks](https://github.com/babakks) in cli/cli#11244 - Handle `HTTP 404` when deleting remote branch in `pr merge` by [@babakks](https://github.com/babakks) in cli/cli#11234 ##### 📚 Docs & Chores - chore: fix function name by [@jinjingroad](https://github.com/jinjingroad) in cli/cli#11149 - chore: update Go version to 1.24 in devcontainer configuration and docs by [@tMinamiii](https://github.com/tMinamiii) in cli/cli#11158 - Ensure lint workflow checks whether 3rd party license and code is up to date by [@andyfeller](https://github.com/andyfeller) in cli/cli#11047 - docs: install\_linux.md: add Solus linux install instructions by [@chax](https://github.com/chax) in cli/cli#10823 - Fix missing newline in install\_linux.md by [@BagToad](https://github.com/BagToad) in cli/cli#11160 - Ensure automation uses pinned go-licenses version by [@andyfeller](https://github.com/andyfeller) in cli/cli#11161 - Add `workflow_dispatch` support to MR Help Wanted check by [@BagToad](https://github.com/BagToad) in cli/cli#11179 - Remove unused `GH_TOKEN` env variable from workflow by [@BagToad](https://github.com/BagToad) in cli/cli#11190 - Add workflow to automate go version bumping by [@williammartin](https://github.com/williammartin) in cli/cli#11189 - Fix inconsistent use of tabs and spaces by [@Stefan-Heimersheim](https://github.com/Stefan-Heimersheim) in cli/cli#11194 - Decouple arg parsing from MR finder by [@babakks](https://github.com/babakks) in cli/cli#11192 - docs: consistently use `apt` in installation instructions by [@tklauser](https://github.com/tklauser) in cli/cli#11216 - Ensure bump go script has git user configured by [@williammartin](https://github.com/williammartin) in cli/cli#11229 - Inject token into bump-go workflow by [@williammartin](https://github.com/williammartin) in cli/cli#11233 - Reinstating Primer Style CLI content within `cli/cli` repository by [@andyfeller](https://github.com/andyfeller) in cli/cli#11060 - Add setup-go to bump-go workflow by [@williammartin](https://github.com/williammartin) in cli/cli#11237 - Ensure GoReleaser does not break on Mac OS and Linux when skipping Windows `.rsyso` generation script by [@andyfeller](https://github.com/andyfeller) in cli/cli#11257 #####

Dependencies - Bump all dependencies except dev-tunnels by [@williammartin](https://github.com/williammartin) in cli/cli#11203 - Update microsoft dev-tunnels to v0.1.13 by [@williammartin](https://github.com/williammartin) in cli/cli#11205 - Consume dependabot minor versions for go modules by [@williammartin](https://github.com/williammartin) in cli/cli#11213 #### New Contributors - [@jinjingroad](https://github.com/jinjingroad) made their first contribution in cli/cli#11149 - [@tMinamiii](https://github.com/tMinamiii) made their first contribution in cli/cli#11158 - [@chax](https://github.com/chax) made their first contribution in cli/cli#10823 - [@dankrzeminski32](https://github.com/dankrzeminski32) made their first contribution in cli/cli#10547 - [@anuraaga](https://github.com/anuraaga) made their first contribution in cli/cli#11038 - [@Stefan-Heimersheim](https://github.com/Stefan-Heimersheim) made their first contribution in cli/cli#11194 **Full Changelog**: cli/cli@v2.74.2...v2.75.0 </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

ejahnGithub added 11 commits May 15, 2025 17:21

init

3a6e42f

wip

510ce73

remove comment

74c6a36

wip

26b46f9

update the lng

3e54568

clean up the code

0a6ce2b

minor fix

7a7c7d6

change verify-asset logic

e9fbe9d

add json format

ca0f984

added the unit test

3108d99

removed unused file

81f1017

ejahnGithub temporarily deployed to cli-automation May 23, 2025 19:52 — with GitHub Actions Inactive

ejahnGithub and others added 7 commits May 23, 2025 15:52

Merge branch 'trunk' into eugene/release-verify

2431a58

update Sprintf

d0da9b1

remove filepath test

ab49b2a

add unit test

71c2361

Merge branch 'trunk' into eugene/release-verify

15b7692

fix test

3b17318

improve test

8e6ed6e

ejahnGithub commented May 30, 2025

View reviewed changes

pkg/cmd/release/attestation/options.go Outdated Show resolved Hide resolved

ejahnGithub commented May 30, 2025

View reviewed changes

pkg/cmd/release/attestation/options.go Outdated Show resolved Hide resolved

ejahnGithub added 2 commits May 30, 2025 09:46

clean the path

e00e1c4

clean the path

6d90ad6

ejahnGithub marked this pull request as ready for review May 30, 2025 17:01

ejahnGithub requested review from a team as code owners May 30, 2025 17:01

ejahnGithub requested a review from andyfeller May 30, 2025 17:01

ejahnGithub temporarily deployed to cli-automation May 30, 2025 17:01 — with GitHub Actions Inactive

cliAutomation added the external pull request originating outside of the CLI core team label May 30, 2025

andyfeller reviewed May 30, 2025

View reviewed changes

ejahnGithub and others added 8 commits May 30, 2025 12:18

debug windows env

4b11087

revert the workflow

96db923

clean the code

df87b15

empty commit

699ccc1

update the artifact and bundle for testing

56f8877

moved to shared lib

bf4b793

moved to shared lib

5048d58

use standardize color roles logic for the logging

d7d9228

ejahnGithub marked this pull request as ready for review May 30, 2025 21:10

ejahnGithub temporarily deployed to cli-automation May 30, 2025 21:10 — with GitHub Actions Inactive

malancas reviewed Jun 2, 2025

View reviewed changes

bdehamer force-pushed the eugene/release-verify branch from 3adea16 to 365fadb Compare June 5, 2025 17:12

refactor to simplify implementation

53cae59

Signed-off-by: Brian DeHamer <bdehamer@github.com>

bdehamer force-pushed the eugene/release-verify branch from 365fadb to 53cae59 Compare June 5, 2025 17:35

bdehamer requested review from andyfeller and malancas June 5, 2025 17:51

malancas approved these changes Jun 5, 2025

View reviewed changes

ejahnGithub added 3 commits June 16, 2025 08:49

Merge branch 'trunk' into eugene/release-verify

8d0161f

Merge branch 'trunk' into eugene/release-verify

898bb42

Merge branch 'trunk' into eugene/release-verify

524aee8

andyfeller suggested changes Jun 17, 2025

View reviewed changes

improve the description for gh release verify cmd

169b909

ejahnGithub requested a review from andyfeller June 19, 2025 15:27

Merge branch 'trunk' into eugene/release-verify

98d7135

andyfeller approved these changes Jun 20, 2025

View reviewed changes

andyfeller merged commit d4efe0b into cli:trunk Jun 20, 2025
10 checks passed

Conversation

ejahnGithub commented May 23, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cliAutomation commented May 30, 2025

Uh oh!

andyfeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

cliAutomation commented May 30, 2025

Uh oh!

Uh oh!

Uh oh!

malancas Jun 2, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bdehamer commented Jun 5, 2025

Uh oh!

andyfeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

andyfeller left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Comments

ejahnGithub commented May 23, 2025 •

edited

Loading